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AMENDMENTS TO THE CLAIMS 

Please cancel claims 1 1, 12, 15, and 16 without prejudice to pursue them in related 
application(s), and amend claims 1-3, 6, 8, 10, 13, 14, 17, 19, 22, 27, 30, 38, 40, and 41, as 
follow. A complete listing of the claims is provided, as follows. 

1 . (Currently Amended) A device for managing network traffic flow, the device comprising: 
a first processor, the first p rocessor configured to 

receive network traffic content, 

determine whether a protocol of the network traffic content matches a prescribed 
protocol of network traffic content that could contain content desired to be detected, and 

store the network traffic content in a stack when the protocol of the network 
traffic content matches the prescribed protocol , whoroin th e stack is associat e d with a 
modul e configur e d to d e t e rmin e wh e th e r tho network traffic cont e nt contains cont e nt 
desir e d to b e d e t e ct e d,; and 

a second processor associated with the stack, wherein the second processor is configured 
to determine whether the network traffic content contains the content desired to be 
detected 

send at l e ast a portion of th e n e twork traffic cont e nt to a m e mory wh e n th e 
protocol of th e n e twork traffic cont e nt match e s th e pr e scribed protocol . 

2. (Currently Amended) The device of claim 1 , wherein the first p rocessor comprises a 
general purpose processor. 

3 . (Currently Amended) The device of claim 1 , wherein the first p rocessor comprises an 
ASIC processor. 

4. (Original) The device of claim 3, wherein the ASIC processor is a semi-custom ASIC 
processor. 
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5. (Original) The device of claim 3, wherein the ASIC processor is a programmable ASIC 
processor. 

6. (Currently Amended) The device of claim 1 , wherein the first processor is further 
configured to send the network traffic content to a user when the protocol of the network traffic 
content does not match the prescribed protocol. 

7. (Original) The device of claim 1, further comprising the stack. 

8. (Currently Amended) The device of claim 7, wherein the stack is implemented in the first 
processor or in anoth e r the second processor. 

9. (Previously Presented) The device of claim 8, wherein the stack is configured to store the 
network traffic content in accordance with the protocol of the network traffic content. 

1 0. (Currently Amended) The device of claim 1 , wherein the first or the second processor is 
further configured to assemble the at least a portion of the network traffic content with the rest of 
the network traffic content, and transmit the network traffic content to a user when it is 
determined that the network traffic content does not contain the content desired to be detected. 

11-12. (Canceled) 

1 3 . (Currently Amended) The device of claim J4_l , wherein the medttl e second processor 
comprises is impl e mented in an ASIC processor. 

14. (Currently Amended) The device of claim 1 , wherein the first or the second p rocessor is 
further configured to flag the network traffic content when the protocol of the network traffic 
content matches the prescribed protocol, and send the flagged network traffic content to the 

memory. 
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15-16. (Canceled) 

1 7. (Currently Amended) The device of claim 44 14, wherein the medttl e second processor 
comprises is implem e nt e d in an ASIC processor. 

18. (Original) The device of claim 1, wherein the content desired to be detected is selected 
from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and 
a packet transmitted by a hacker. 

1 9. (Currently Amended) A method for managing network traffic flow, the method 
comprising: 

receiving network traffic content at a first processor ; 

determining whether a protocol of the network traffic content matches with a prescribed 
protocol of network traffic content that could contain content desired to be detected; 

storing the network traffic content in a stack when the protocol of the network traffic 
content matches the prescribed protocol, the stack associated with a module including a second 
processor that is configured to determine whether the network traffic content contain content 
desired to be detected; and 

sending at least a portion of the network traffic content to a memory when the protocol of 
the network traffic content matches the prescribed protocol; 

wherein the first and second processors are parts of a device . 

20. (Original) The method of claim 19, wherein the network traffic content is stored in the 
stack in accordance with the protocol of the network traffic content. 

2 1 . (Previously Presented) The method of claim 1 9, further comprising: 
assembling the at least a portion of the network traffic content with the rest of the 

network traffic content, and sending the network traffic content to a user when it is determined 
that the network traffic content does not contain the content desired to be detected. 
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11. (Cuirently Amended) The method of claim 1 9, further comprising: 

flagging the network traffic content when the protocol of the network traffic content 

matches the prescribed protocol; and 

storing the flagged network traffic content in a memoryt. 

23-26. (Canceled) 

27. (Currently Amended) A device for managing network traffic flow, the device comprising: 

a first processor, the first processor configured to 
receive network traffic content, 
flag the network traffic content, 

send the flagged network traffic content to a module, the module configured to 
pass unflagged data to a user and prevent flagged data fi-om being sent to the user, and 

send a copy of the network traffic content to a second processor, the second 
processor configured to determine whether the network traffic content contains content 

desired to be detected : and 
the second processor . 

28. (Original) The device of claim 27, wherein the first processor is fiirther configured to 
transmit the network traffic content to a user when it is determined that the network traffic 
content does not contain the content desired to be detected. 

29 . (Original) The device of claim 27, wherein the module comprises a memory, a buffer, or 
at least a portion of a processor. 

30. (Currently Amended) A method for managing network traffic flow, the method 

comprising: 

receiving network traffic content at a first processor : 
flagging the network traffic content; 
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sending the flagged network traffic content to a module, the module configured to pass 
unflagged data to a user and prevent flagged data fi-om being sent to the user; and 

sending a copy of the network traffic content to a second p rocessor, the second p rocessor 
configured to determine whether the network traffic content contains content desired to be 

detected; 

wherein the first and second processors are parts of a device . 

3 1 . (Original) The method of claim 30, further comprising transmitting the network traffic 
content to a user when it is determined that the network traffic content does not contain the 

content desired to be detected. 

32. (Previously Presented) The device of claim 1 , fiirther comprising the memory. 

33 . (Previously Presented) The device of claim 27, wherein the first processor is configured 
to pass a portion of the network traffic content downstream before the second processor finishes 
processing the network traffic content. 

34. (Previously Presented) The device of claim 27, wherein the first processor and the second 
processor are parts of a processor. 

35. (Previously Presented) The device of claim 34, wherein the processor comprises an ASIC 
processor. 

36. (Previously Presented) The device of claim 27, wherein the first processor is configured 
to flag the network traffic content by modifying data associated with the network traffic content 
or by inserting data to the network traffic content. 

37. (Previously Presented) The method of claim 30, wherein a portion of the network traffic 
content is passed downstream before the processor finishes processing the network traffic 
content. 
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3 8 . (Currently Amended) The method of claim 30, wherein the second p rocessor comprises 

an ASIC processor. 

39. (Previously Presented) The method of claim 30, wherein the network traffic content is 
flagged by modifying data associated with the network traffic content or by inserting data to the 
network traffic content. 

40. (Currently Amended) A device for managing network traffic flow, the device comprising: 
a first processor, the first processor configured to 



receive network traffic content, 

pass a first portion of the network traffic content downstream, and 
pass a second portion of the network traffic content to a stack for allowing the 
second portion to be scanned for content that is desired to be detecte d; and 
a second processor that is configured to scan the second portion for the content desired to 
be detected . 

4 1 . (Currently Amended) The device of claim 40, wherein the first or the second p rocessor is 
further configured to pass the second portion downstream after the second portion is scanned. 

42. (Previously Presented) The device of claim 40, wherein the first portion of the network 
traffic content is not scanned for the content that is desired to be detected. 
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